Enforce Passphrase on keys - openssh

This is a discussion on Enforce Passphrase on keys - openssh ; Hi! I've been trying to dig around and find a way to enforce passphrases on private keys when you authenticate. The closest post that I can find would be... http://marc.info/?l=openssh-unix-dev...1429416956&w=2 --- if openssl rsa -noout -passin pass:none -in /path/to/key ; ...

+ Reply to Thread
Results 1 to 2 of 2

Thread: Enforce Passphrase on keys

  1. Enforce Passphrase on keys

    Hi!

    I've been trying to dig around and find a way to enforce passphrases
    on private keys when you authenticate. The closest post that I can
    find would be...

    http://marc.info/?l=openssh-unix-dev...1429416956&w=2

    ---
    if openssl rsa -noout -passin pass:none -in /path/to/key ; then
    echo user is a dork
    fi
    ---

    However, how does one go about implementing this if their private key
    is on the local system? If the private key is on your server, you
    could probably put it in a login script. But being that it is on the
    local system, how would you go about verifying the passphrase?

    The reason why I'm going down this road is because we have had
    problems where a user's private key is compromised. Some user's do
    not use passphrases on their private keys. Once a key is copied off
    the system, the attacker then logs in without worrying about
    passwords. My idea is to have the server deny the connection if a
    passphrase does not exist on a private key.


    Thanks!


  2. Re: Enforce Passphrase on keys

    On Thu, 2008-07-03 at 09:31 -0500, Michael Wisniewski wrote:
    > Hi!
    >
    > I've been trying to dig around and find a way to enforce passphrases
    > on private keys when you authenticate. The closest post that I can
    > find would be...
    >
    > http://marc.info/?l=openssh-unix-dev...1429416956&w=2
    >
    > ---
    > if openssl rsa -noout -passin pass:none -in /path/to/key ; then
    > echo user is a dork
    > fi
    > ---
    >
    > However, how does one go about implementing this if their private key
    > is on the local system? If the private key is on your server, you
    > could probably put it in a login script. But being that it is on the
    > local system, how would you go about verifying the passphrase?
    >
    > The reason why I'm going down this road is because we have had
    > problems where a user's private key is compromised. Some user's do
    > not use passphrases on their private keys. Once a key is copied off
    > the system, the attacker then logs in without worrying about
    > passwords. My idea is to have the server deny the connection if a
    > passphrase does not exist on a private key.
    >
    >
    > Thanks!


    don't thing something like this is possible. the way to go is to enforce
    the security policies on the local system (so it does not get
    compromised) and user education. appropriate action against the user who
    did not follow company security policies should be taken, let them be
    aware of that.

    other method would be to replace the keys authentication with something
    more scalable, e.g. Kerberos.

    Martin.


+ Reply to Thread